Known vulnerabilities in FortiAnalyzer

Software: FortiAnalyzer
Software CPE: cpe:2.3:a:fortinet:fortianalyzer:*:*:*:*:*:*:*:*
Total vulnerabilities: 109
Public exploits: 7
Known exploited (KEV): 2
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting FortiAnalyzer FortiAnalyzer is affected by 109 known vulnerabilities: 1 critical, 10 high, 35 medium, 63 low Critical High Medium Low

Vulnerabilities (109)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU131204 - Use of Potentially Dangerous Function
CVE-2025-67604
CWE-676 Low
No
No
7.4.9, 7.6.5 12.05.2026 SB2026051377
#VU126009 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2025-68649
CWE-22 Low
No
No
7.4.8, 7.6.5 14.04.2026 SB20260414132
#VU125996 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-61848
CWE-89 Low
No
No
7.4.9, 7.6.5 14.04.2026 SB20260414120
#VU123726 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-49784
CWE-89 Low
No
No
7.4.8, 7.6.5 10.03.2026 SB2026031088
#VU123724 - Use of Externally-Controlled Format String
CVE-2025-68648
CWE-134 Low
No
No
7.4.8, 7.6.5 10.03.2026 SB2026031086
#VU123723 - Authentication Bypass Using an Alternate Path or Channel
CVE-2026-22572
CWE-288 Medium
No
No
7.4.8, 7.6.4 10.03.2026 SB2026031085
#VU123717 - Hidden Functionality (Backdoor)
CVE-2025-48418
CWE-912 Low
No
No
7.0.15, 7.2.11, 7.4.8, 7.6.4 10.03.2026 SB2026031079
#VU123714 - Improper Restriction of Excessive Authentication Attempts
CVE-2026-22629
CWE-307 Low
No
No
7.6.5 10.03.2026 SB2026031076
#VU123712 - Improper Certificate Validation
CVE-2025-68482
CWE-295 Medium
No
No
7.4.9, 7.6.5 10.03.2026 SB2026031074
#VU121971 - Improper Verification of Cryptographic Signature
CVE-2026-24858
CWE-347 Critical
Available
Exploited
7.0.16, 7.2.12, 7.4.10, 7.6.6 23.01.2026 SB2026012392
#VU119426 - Key Management Errors
CVE-2024-40593
CWE-320 Low
No
No
7.2.6, 7.4.3 09.12.2025 SB2025120942
#VU117210 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2025-54973
CWE-362 Medium
No
No
7.0.14, 7.2.11, 7.4.7, 7.6.3 15.10.2025 SB2025101568
#VU117141 - Improper Authentication
CVE-2025-53845
CWE-287 Medium
No
No
7.4.7, 7.6.4 15.10.2025 SB2025101501
#VU117134 - Heap-based Buffer Overflow
CVE-2024-50571
CWE-122 Low
No
No
7.0.14, 7.2.10, 7.4.6, 7.6.3 14.10.2025 SB20251014106
#VU112527 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2025-24474
CWE-89 Low
No
No
7.4.7, 7.6.2 08.07.2025 SB2025070869
#VU107372 - Weak Authentication
CVE-2024-50563
CWE-1390 High
No
No
7.4.4, 7.6.2 10.04.2025 SB2025041046
#VU107373 - Weak Authentication
CVE-2024-48886
CWE-1390 High
No
No
7.4.4, 7.6.2 10.04.2025 SB2025041046
#VU107367 - Buffer Underwrite ('Buffer Underflow')
CVE-2024-35276
CWE-124 Medium
No
No
6.4.15, 7.0.13, 7.2.6, 7.4.4 10.04.2025 SB2025041041
#VU107362 - Improper Privilege Management
CVE-2024-45331
CWE-269 Low
No
No
7.2.6, 7.4.4 10.04.2025 SB2025041038
#VU104034 - Improper input validation
CVE-2025-26466
CWE-20 Medium
Available
No
7.2.11, 7.4.7, 7.6.3 18.02.2025 SB2025021815
SB2025021830
SB2025021840
and 25 more


Showing elements 1 - 20 out of 109